How do you omit fields?

[un-focused]

Let's say we have the following User model.
{ id: ID, email: string, username: string }

Then I want to define 2 queries:

1. Used by the owner to get their settings page so it contains sensitive information such as email (perhaps sin number)
2. Used by other users to search for a user (by username) & we do NOT want to expose the email or sin number

I have been researching the documentation & cannot find how to accomplish this. I was thinking to grab the info for the fields manually & parse it per query but that seems like an oversight.

[un-focused]

I am considering using 2 models & making different resolvers

[MichalLytek]

2 datasets means 2 object types.
Alternatively, you can make some fields nullable and return null in not owner context.

[un-focused]

Interesting approach with the context. I am new to graphql in general & have been learning. It is awesome to see the maintainer being active in the community :)

A step above the context, what if I used the Authorized decorator on the field & then blocked the query if the client attempts to get the property via an error? Would that be against TypeGraphQL standard practise?

[un-focused]

I've been looking into the Authorized decorator & the AuthChecker function & it looks like there isn't an easy way to extract whether the function the client is attempting to retrieve requires authorization

[MichalLytek]

If you just want to prevent reading some fields by some users, @Authorized is the right choice to guard the fields.
However, with the default logic, it works only by roles, so it's hard to achieve the "owner access own details" scenario.

[un-focused]

Gotcha, I will play around with this more, & if I come up with something, I'll post it here :)

[un-focused]

Update: So I have tried multiple different techniques but there doesn't seem to be a nice way to implement this by default in the library. I could make a custom decorator that stores the values & then check it in the resolver function. Still thinking about this. Additionally, I can make it so for array the field is off limits but for individual queries we can allow it but the UserID must match the user getting the object

[un-focused]

I just don't think it's clean to have 2 models named User & then PrivateUser or 2 functions, one that gets the current user & another that gets other users.

[un-focused]

I am looking into passing the auth token in the context but I read elsewhere that this is not a good idea. Instead of this, I might use a custom decorator. Still hoping for a clean inbuilt solution.

The general issue that I am trying to solve is one function that I want to reuse for settings page & profile page, the fields overlap 90%, & the model contains all the fields. It's just that some of them should not be accessible for other users & only for the owner such as email!